DNS activity - BlueCat DNS Edge

DNS Edge User Guide

prodname
BlueCat DNS Edge

The DNS activity screen displays DNS queries from the configured sites. Available information includes the date and time of the query, the source and site, the query name and type, the response, and policy action (block, allow, monitor, or redirect) that was taken. You can filter the DNS activity list by time, sites, site groups, and other criteria.

Viewing DNS activity

  1. In the DNS Edge window, click .
  2. Select the DNS Activity or Threat Activity tab. For more information about the Threat Activity tab, see Threat activity.
  3. Use the filter icons or the following filter commands to search for DNS queries by the following criteria:
    • date & time
    • latency
    • site
    • source IP
    • query type
    • query name
    • response code
    • response IP
    • policy name
    • policy action
    • threat type
    • threat indicator

    Criteria can be combined, and DNS Edge will only return queries when all of the specified conditions are met.

    Examples

    /sitename TorontoSite /from 08-17-2017 00:00:00 /to 08-17-2017 04:00:00

    /at 03-17-2017 22:30:00 /sitename GlasgowSite

    When you enter the filter command, the results display and the text in the command bar turns green. Results remain filtered until you begin typing another command.

  4. Click to add another tab. In the Add Tab window, select the available columns on the left, then click Add Tab. You must enter a name for the tab in the Title field. You can add multiple columns to the tab, and click and drag a selected column on the right to re-order the columns. To delete the tab, click the delete button beside the tab name.
    Note: The Date & Time column is selected by default.
  5. Click to select the columns you want displayed in the tab. In the Update Tab window, select the available columns on the left, then click Update Tab. You can click and drag a selected column on the right to re-order the columns. To restore the default columns and order, click Restore Defaults.

  6. To view detailed information about a DNS query, click the query.
    dns query info

    In the DNS query information panel, you can click links to view sites, namespaces, policies, and (for Vol Tunnel threat indicators) system lists associated with the query. When you click a link, a new tab opens in the panel, allowing you to return to the query information easily.

    Click next to different fields to filter the DNS activity results based on the value of that field.

    Click Inspect Client Activity to retrieve additional query information from the source IP of the current query. For more information, refer to Client activity.

  7. Click to download a CSV file containing detailed query log information about the DNS Activity or Threat Activity based on the selected filters. The CSV file contains up to 10,000 queries.
    Note: If a query contains multiple Answer and Authority records, only the first five of each record are returned. However, the CSV file displays the total count of Answer and Authority records for each query.
  8. To return to the map view, click .

Filter command tips

  • Enter times in 24-hour format (HH:MM:SS). All digits are required.
  • Enter dates in MM-DD-YYYY format (03-15-2017). All digits are required.
  • You can copy a list of filter values and paste them to advanced filter command bar.

    For example:

    If you copy the following list for the /queryname filter command:

    abc.com

    meow.com

    ham.com

    Then paste them to the advanced filter command bar, the list of items will display as comma separated:

  • If you enter the incorrect filter commands and values, a list of errors will display below the advanced filter command bar. The number on the error indicates the location of the error in the command bar. When you click on the error, the cursor moves to the location of the error.

  • Filters become active when you press Enter and remain active until you change the text in the command bar. Active filters are indicated by green text in the command bar.
  • Click to view the filter history. You can delete and pin items in the list.
    Note: You can pin up to 10 items in the list.

  • You can copy the URL of a filter by clicking , then right-clicking the filter > Copy Link Address. You can also copy the URL in the URL field of your browser.
  • You can extend your search for more than one item at a time by adding multiple items, separated by commas. For example:

    /policyaction block, redirect

    Note: The extended search is only available for the following filters:
    • /site
    • /source
    • /querytype
    • /queryname
    • /protocol
    • /namespace
    • /response
    • /policyname
    • /policyaction
    • /threattype
    • /threatind
  • You can use one or more filters at a time on the command line. For example, you can combine filters for date/time, policy action, and site name.
  • Using the DNS Edge dashboard, you can select a time range on the graph to filter DNS queries in the DNS Activity window. You can deselect one or more policy actions to filter both by the selected time range, and the visible policy actions.


    dashboard select time range